Monitoring concept in a control device

ABSTRACT

A monitoring process for monitoring a computing element in a control device of a motor vehicle, wherein the computing element includes three program modules by which the performance of the motor vehicle is influenced. The computing element is executed on a processor, wherein the processor includes a functional computer and a monitoring computer that is physically independent of the functional computer, and the monitoring computer includes two monitoring units that are independent of each other.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is the U.S. National Phase Application ofPCT/DE2010/001490, filed Dec. 20, 2010, which claims priority to GermanPatent Application No. 10 2009 059 088.9, filed Dec. 18, 2009, thecontents of such applications being incorporated by reference herein.

FIELD OF THE INVENTION

The invention relates to a method for monitoring a computing element, toa computing element as well as to a processor and to a monitoringcomputer for carrying out the method.

BACKGROUND OF THE INVENTION

There are various concepts for designing a control device with acomputing element for the use in a motor vehicle in such a manner thatthe control device is free of single defects or inherently safe.Monitoring in the three-layer concept is one possibility of achieving aninherently safe control device.

A method and a device for controlling a drive unit of a vehicle areknown from DE 44 38 714 A1, which is incorporated by reference, whereinthe control device for power control has a single computing elementonly. The computing element performs both switch-off path control andmonitoring, wherein operational reliability and service quality areguaranteed by at least two layers for control and monitoring beingprovided in a single computing element, said layers being independent ofeach other, wherein the functions for power control are determined in afirst layer and said functions, and thus the operatability of thecomputing element itself, are monitored in a second layer, particularlyin cooperation with a monitoring module.

Furthermore, DE 44 38 714 A1 describes a third layer that performs aprogram flow check of the second layer. This monitoring by the thirdlayer considerably enhances the reliability and service quality of thecontrol device. In particular, the program flow check in the monitoringmodule is performed in the form of dialog communication.

The three-layer monitoring concept (E-Gas concept) is preferably used inengine control devices of vehicles to monitor electronic engine controlsystems, wherein the engine control device consists of the so-calledfunctional computer and the monitoring computer. The functional computerand the monitoring computer communicate by means of a dialog method andhave separate switch-off paths.

Layer 1 comprises the actual functional module for the functionalcontrol of the drive unit of the vehicle and is therefore also referredto as “functional layer”. It includes engine control functions, interalia for the conversion of the requested engine torques, componentmonitoring, the diagnosis of the input and output quantities, and thecontrol of the system reactions when an error has been detected. Layer 1is executed on the functional computer.

Layer 2 is also referred to as “function monitoring layer”. It comprisesthe safety module and is also executed on the functional computer. Itdetects the defective execution of a monitoring-relevant extent of thefunctional module of Layer 1, inter alia by monitoring the calculatedtorques or the vehicle acceleration. In the event of an error, systemreactions are triggered, e.g., safety-relevant output stages aredisabled.

Layer 2 is executed in a functional-computer hardware area that issecured by Layer 3. Layer 3 is also referred to as “computer monitoringlayer”. It comprises the monitoring module on an independent functionalcomputer with instruction set test, program flow check, ADC test as wellas cyclic and complete memory tests of Layer 2. The monitoring module isexecuted on a functional computer. The monitoring computer that isindependent of the functional computer tests the proper processing ofthe program instructions of the functional computer, said test being adialog method. In the event of an error, system reactions are triggeredindependently of the functional computer.

In present-day electronic engine control systems, the entire functionaland monitoring software is integrated in a control device. Themonitoring concept may also be realized in other vehicle controldevices, in particular in gear control devices.

Monitoring concepts in which a monitoring computer performs more thanone program flow check in the functional computer by means of a singlemonitoring unit are known from the state of the art, wherein said singlemonitoring unit has to synchronize the individual responses from theindividual program flow checks as well as to merge the individualresponses into an overall response, wherein errors may occur both in thesynchronizing operation and in the response merger operation.

BRIEF DESCRIPTION

Therefore, an aspect of the present invention is to improve the knownmethods for monitoring a computing element in a motor vehicle controldevice.

According to an aspect of the invention, a method is provided formonitoring a computing element in a control device of a motor vehicle,wherein the computing element comprises three program modules by whichthe performance of the motor vehicle is influenced, wherein thecomputing element generates, by the program modules and dependently onat least one input quantity, at least one quantity for controlling atleast one function of the motor vehicle, wherein: the first programmodule is a functional module for the functional control of the motorvehicle, the second program module is a safety module for checking thefunctional module, the third program module is a monitoring module atleast for checking the safety module, wherein the monitoring modulecomprises two monitoring elements that are independent of each other,and one state machine each for configuring an associated monitoring unitis passed through in the computing element when the control device isswitched on, and the monitoring units start monitoring by the respectivemonitoring element if both state machines have been passed throughsuccessfully.

The inventive computing element in the motor vehicle control devicecomprises three software program modules: a functional module for thefunctional control of the motor vehicle, a safety module for checkingthe functional module, and a monitoring module at least for checking thesafety module.

The core of an aspect of the invention consists in the monitoring modulecomprising two monitoring elements that are independent of each otherand are realized in the form of software, wherein each monitoringelement is assigned to one monitoring unit each, said monitoring unitsbeing realized in the form of hardware.

In this manner, software tasks that are completely different from eachother in time can be monitored. The safety-critical path is not enabledunless both of them deliver correct responses in the correct timewindow.

Particularly when the control device is switched on, one state machineeach for configuring an associated monitoring unit is passed through inthe computing element. A state machine is a behavioural model consistingof states, state transitions and actions. A state stores the informationabout the past and reflects the changes in the input that have occurredin the period from the system start-up till the current moment. A statetransition shows a change in the state of the state machine and isdescribed by logical conditions that must be fulfilled in order to makethe transition possible. An action is the output of the state machinethat occurs in a certain situation.

If both state machines have been passed through successfully, the twomonitoring units advantageously start the monitoring of the computingelement by means of the respective monitoring element.

As a first check, the first monitoring unit performs particularly amemory test and a program flow check in the safety module by means ofthe first monitoring element. Furthermore, the second monitoring unitperforms, as a second check, particularly an instruction set test and anADC test in the monitoring module by means of the second monitoringelement. Advantageously, the respective checks are performed inso-called test paths.

A switch-off path check particularly guarantees that the functionalcomputer or the monitoring computer can correctly disable thesafety-relevant output stages in the event of an error, for example.

It is particularly important to emphasize that one error counter each isoperated in the event of an error occurring in one of the two checks anda system reaction is triggered by the monitoring computer independentlyof the functional module when freely programmable error reactionthresholds are exceeded.

Such a system reaction may consist in putting the vehicle in arestricted emergency mode that enables the vehicle to only just roll toa stop on the hard shoulder of a roadway, for example.

For enhanced safety, error counting is advantageously asymmetrical,i.e., counting up twice in the event of a wrong response occurring inthe dialog method, but counting down only once in the event of a correctresponse.

Preferably, the corresponding monitoring unit is configured in thecomputing element when the control device is initialized. In thisprocess, e.g., a response time and a response time window of the dialogmethod as well as a disable threshold for the safety-relevant outputstages and a reset threshold together with a reset enable are fixed ineach case apart from other parameters, wherein it is quite possible thatthe parameters are not the same for each monitoring unit. Alternatively,both monitoring units may be equally configured.

Particularly advantageously, configuring a corresponding monitoring unitis only possible in a corresponding NIT state and only defined statetransitions are permitted in a state machine. Furthermore, particularlya return to the NIT state is only performed via a state RESET, therebypreventing the parameters from being intentionally or unintentionallychanged later.

A further aspect of the invention consists in providing a processor withan above-described computing element in a control device of a motorvehicle, said processor being improved as against the cited state of theart.

According to an aspect of the invention, this is achieved by a processorwith a computing element, wherein the processor essentially comprises afunctional computer and a monitoring computer, and wherein thefunctional module, the safety module and the monitoring module areexecuted on the functional computer and the monitoring computercommunicates with the functional computer by means of a dialog methodvia an interface, wherein the functional computer and the monitoringcomputer are physically independent of each other and the monitoringcomputer comprises two monitoring units that are independent of eachother, wherein for monitoring the proper processing of the programinstructions of the functional computer, one check each can be performedin the functional computer by each monitoring unit.

As set out in detail above, the computing element of the control deviceessentially comprises the three program modules “functional module”,“safety module” and “monitoring module”, and the computing element isexecuted on the processor. The processor is particularly subdivided intoa functional computer and a monitoring computer, wherein the functionalmodule, the safety module and the monitoring module are executed on thefunctional computer. The monitoring computer usually communicates withthe functional computer by means of a dialog method via an interface.

The core of an aspect of the invention consists in the functionalcomputer and the monitoring computer being physically independent ofeach other in particular and the monitoring computer furthermorecomprising two monitoring units that are functionally independent ofeach other. For monitoring the proper processing of the programinstructions of the functional computer, one check each can beadvantageously performed in the functional computer by each monitoringunit, whereby the checking method can be advantageously accelerated andmade safer.

BRIEF DESCRIPTION OF THE DRAWINGS

In the following description, the features and details of aspects of theinvention will be explained in greater detail on the basis of exemplaryembodiments in connection with the attached drawings, wherein thefeatures and contexts described in individual variants are applicable inprinciple to all exemplary embodiments. In the drawings,

FIG. 1 shows a three-layer concept subdivided into modules (software)and computers (hardware), and

FIG. 2 shows a state machine with states, transitions and conditions.

DETAILED DESCRIPTION OF THE INVENTION

In FIG. 1, the boxes marked with dot-dash lines or dashed lines show onehardware component each. The boxes marked with continuous lines show onesoftware component each. The straight arrows between the boxes show onedata exchange each.

FIG. 1 shows a three-layer monitoring model that is basically known fromthe E-Gas concept, said model being used, e.g., in an engine controldevice or in a gear control device in motor vehicles.

The first box marked with a dot-dash line indicates the functionalcomputer (FR) of the processor. The second box marked with a dot-dashline indicates the monitoring computer (UR) of the processor. Thefunctional computer (FR) and the monitoring computer (UR) are arrangedon the processor in such a manner that they are physically separate fromeach other. The monitoring computer (UR) may be an ASIC computer, forexample. The three program modules functional module (E1), safety module(E2) and monitoring module (E3) are executed on the functional computer(FR).

The functional module (E1) represents Layer 1 of the E-Gas concept,which Layer 1 is also referred to as “functional layer”. Layer 1 isparticularly used for the functional control of the drive unit of thevehicle. As explained above, Layer 1 includes, e.g., engine controlfunctions, inter alia for the conversion of the requested enginetorques, component monitoring, the diagnosis of the input and outputquantities, and the control of the system reactions when an error hasbeen detected.

The safety module (E2) represents Layer 2 of the E-Gas concept, whichLayer 2 is also referred to as “function monitoring layer”. Layer 2detects the defective execution of a monitoring-relevant extent of thefunctional module (E1) of Layer 1. In particular, the calculated torquesor, e.g., the vehicle acceleration are monitored. The occurrence of anerror particularly results in system reactions being triggered. Thesafety module (E2) is primarily executed in a hardware area of thefunctional computer (FR), said hardware area being secured by themonitoring module (E3).

The monitoring module (E3) represents Layer 3 of the E-Gas concept,which Layer 3 is also referred to as “computer monitoring layer”. Themonitoring module (E3) is particularly executed on the functionalcomputer (FR) that is independent of the monitoring computer (UR). Themonitoring computer (UR) tests the proper processing of the programinstructions of the functional computer (FR), said test being at leastone dialog method, for example. The occurrence of an error particularlyresults in system reactions being triggered independently of thefunctional computer (FR).

The monitoring computer (UR) essentially comprises two monitoring units(MU1, MU2) that are independent of each other. On each monitoring unit(MU1, MU2), a corresponding monitoring element (ME1, ME2) is executedfor checking (K1, K2) the safety module (E2) and the monitoring module(E3), respectively.

For example, the first monitoring unit (MU1) performs, as a first check(K1), a memory test and a program flow check in the safety module (E2)by means of the first monitoring element (ME1) via the first test path(TP1).

The second monitoring unit (MU2) preferably performs, as a second check(K2), an instruction set test and an ADC test in the monitoring module(E3) by means of the second monitoring element (ME2) via the second testpath (TP2), said second check (K2) being performed parallel to andindependently of check (K1). The second check (K2) could also beperformed on the first monitoring unit (MU1) by means of the firstmonitoring element (ME1) via the first test path (TP1), and vice versa.

In particular, the aforementioned program flow check is performed in theform of a dialog between a monitoring unit (MU1, MU2) and the functionalcomputer (FR). The corresponding inquiries are generated, e.g., in aninquiry generator (FG) that is assigned to a monitoring element (ME1,ME2). The inquiry generators (FG) are equally designed, but theinquiries are selected at random so that the inquiries of the monitoringunit (MU1) and those of the monitoring unit (MU2) practically differfrom each other in each case.

In the event of an error occurring during the check (K1, K2), one errorcounter each is advantageously incremented. When a corresponding freelyprogrammable error reaction threshold is exceeded, a system reaction istriggered particularly by the monitoring module (E3) independently ofthe functional module (E1). The freely programmable error reactionthresholds may be different for different system reactions, such asdisabling the safety-relevant output stages or resetting the functionalcomputer (FR). When one of the monitoring units (MU1, MU2) generates areset, the complete system including the state machine (SM1, SM2) andthe functional computer (FR) is reset. For example, configuration couldalso be such that only errors of the monitoring unit (MU1) result in areset and errors of the monitoring unit (MU2) only result in thesafety-relevant output stage being disabled.

Furthermore, the generation of a reset instruction as an error reactionmay be optionally enabled or disabled.

Advantageously, the outputs (URA) of the monitoring computer (UR) arecomplementary outputs. In the event of a total loss of power of themonitoring computer (UR) that is, e.g., an ASIC computer (caused by,e.g., a chip breakdown or a latchup, i.e., a transition of asemiconductor component to a low-impedance state), it is assumed thatall outputs of the monitoring computer (UR) are simultaneously on a highlevel or simultaneously on a low level. In such a case, thecomplementary outputs, together with external wiring (not shown), makesure that the safety path of the system, and thus the safety-relevantoutput stages of the system, are disabled. The external wiring consistsof, e.g., resistors and transistors and makes sure that only just onecombination of the complementary outputs enables the safety-relevantoutput stages.

FIG. 2 shows a state machine. Advantageously, the state machine can berealized with little hardware, wherein this embodiment of the statemachine is faster, safer and less interference-prone than a statemachine realized in the form of software. Furthermore, it cannot bemanipulated. As set out in the introductory part of the description, astate machine is a behavioural model consisting of states, statetransitions and actions. A state stores the information about the pastand reflects the changes in the input that have occurred in the periodfrom the system start-up till the current moment. A state transitionshows a change in the state of the state machine and is described bylogical conditions that must be fulfilled in order to make thetransition possible. An action is the output of the state machine thatoccurs in a certain situation. In digital circuits, the state machinesare mainly realized by stored program control systems, logic gates,flip-flops or relays. For the implementation of the hardware, oneusually uses a register for storing the state variables, a logic unitthat selects the state transitions, and a further logic unit that isresponsible for the output. A specific state machine (SM1, SM2) isassigned to each monitoring element (ME1, ME2).

The (INIT) state is taken on when the control device is initialized orafter a reset of the control device. In the (INIT) state, the monitoringunit (MU1, MU2) is configured by the functional module (E1) via acommunications interface between the monitoring computer (UR) and thefunctional computer (FR), wherein particularly the response time, theresponse time window, the error reaction threshold, especially thedisable threshold (thresh) and the reset threshold (reset thresh) arefixed.

The response time that is fixed while the state machine (SM1, SM2) ispassed through is essentially freely configurable and is usually in therange between 1 ms and 255 ms.

In particular, the response time window is also fixed in the statemachine and is primarily in the range between 1 ms and 255 ms. Inparticular, the ratio that the response time bears to the response timewindow is freely scalable.

Furthermore, the initial value of the error counter is automatically setabove the disable threshold (thresh) in order to make sure that theerror counter remains disabled in the (NIT) state. By action (EOI) (=EndOf NIT State), the configuration of the monitoring element (ME1, ME2) iscompleted and cannot be changed anymore. Thus, the state transition tostate (SOPCDIS) (=Switch Off Path Check Disable) is accomplished,wherein (SOPC) is the switch-off path check, wherein a switch-off pathcheck can guarantee that the functional computer or the monitoringcomputer can correctly disable the safety-relevant output power stagesin the event of an error, for example. In this state, the output powerstages are not enabled, yet.

During the switch-off path check, states (SOPCDIS) and (SOPCENA) aretaken on in the state machine. The output stages are disabled in thefirst state and enabled in the second state. The advantage of thissolution consists in the fact that the responses can be sent during theswitch-off path check as fast as possible with no consideration for theresponse time window. Thus, the run-up time of the system can be keptshort.

When state (SOPCDIS) is reached, the SOPC timer is started among otherthings. The SOPC timer measures the time until instruction (EOSOPC)(=End of SOPC). If the check takes too long, it is aborted and thetransition from state (SOPCDIS) to state (RESET) is executed by means ofaction (SOPC timeout).

In state (SOPCDIS), the dialog between the monitoring computer (UR) andthe functional computer (FR) preferably starts without any timerestriction in order to perform the check as fast as possible, i.e., theresponse time window is open. The error counter is incremented in theevent of a wrong response. If the error counter is below a disablethreshold (thresh), the transition to state (SOPCENA) (=Switch Off PathCheck Enable) is executed, in particular immediately, via condition(EC<disable thresh). Thus, the output power stages are enabled.

The transition from state (SOPCDIS) to state (DISABLE) is executed viacondition (EOSOPC) (=End Of Switch Off Path Check) that is triggered bythe communications interface between the functional computer (FR) andthe monitoring computer (UR). The output power stages remain disabled,as defined in state (SOPCDIS). The only condition is the correct commandbefore condition (SOPC timeout) expires.

When state (SOPCENA) is reached, in particular starting from state(SOPCDIS), the SOPC timer advantageously runs on. The dialog between themonitoring computer (UR) and the functional computer (FR) runs onwithout any time restriction in this state, too. When the error counterhas reached or exceeded a disable threshold (thresh), a transition backto state (SOPCDIS) is particularly executed via condition (EC>=disablethresh).

If the switch-off path check takes too long, it is aborted and thetransition from state (SOPCENA) to state (RESET) is executed viacondition (SOPC timeout). The following transition from state (RESET) tostate (INIT) is executed automatically.

The transition from state (SOPCENA) to state (NORMAL) is mainly executedvia condition (EOSOPC) that is triggered by the communications interfaceagain.

In state (NORMAL), the output power stages are enabled unless they wereenabled in a previous state. In this state, the dialog between themonitoring computer (UR) and the functional computer (FR) is continued,wherein particularly the count of the error counter is taken over fromthe previous state. In contrast to states (SOPCENA) and (SOPCDIS) of theswitch-off path check, there is preferably a time restriction withregard to the response time and the response time window in this state.

For ensuring runtime monitoring of the operating system of thefunctional computer, the response must not come too early or too late.The response time is the latest possible moment for sending theresponse. Secondly, a “closed window” is configured. A response must notbe sent here. The difference between the response time and the “closedwindow” is the “open window” (response time window).

The response time and the response time window were programmed before instate (INIT). The error counter is advantageously incremented both inthe event of a wrong response and in the event of the response time orthe response time window being exceeded. In the event of a disablethreshold (thresh) being reached or exceeded, the transition to state(DISABLE) is executed via condition (EC>=disable thresh).

In state (DISABLE), the output power stages are disabled. In this state,the dialog between the monitoring computer (UR) and the functionalcomputer (FR) is continued with the count of the error counter beingunchanged. There is a time restriction with regard to the response timeand the response time window in this state, too. The error counter isincremented, also in this state, both in the event of a wrong responseand in the event of the response time or the response time window beingexceeded. In the event of the threshold (thresh) being fallen below, thetransition back to state (NORMAL) is executed via condition (EC<disablethresh). In state (NORMAL), the output power stages are enabled again.

As soon as the error counter has reached a reset threshold (resetthresh) in state (DISABLE) and the register for reset enable has thepreset value of 1, the transition to state (RESET) is executed viacondition (EC>=reset thresh AND i_req_rst_en=1). The followingtransition from state (RESET) to state (INIT) is executed automaticallyagain.

The state (SOPCENA) may be omitted in the state machine in order to makeoverall execution in the state machine even faster. There will be nofast switch-off path check in this case.

If both state machines have been passed through successfully, the twomonitoring units advantageously start the monitoring of the computingelement by means of the respective monitoring element in state (NORMAL).

In summary, it can be concluded that the inventive monitoring conceptfor monitoring a computing element in a control device of a motorvehicle represents an improvement as against the known monitoringconcepts with regard to swiftness, programming effort and safety.

The invention claimed is:
 1. A method for monitoring a computing elementin a control device of a motor vehicle, wherein the computing elementcomprises three program modules by which a performance of the motorvehicle is influenced, wherein the computing element generates, by theprogram modules and dependently on at least one input quantity, at leastone quantity for controlling at least one function of the motor vehicle,wherein: the first program module is a functional module for functionalcontrol of the motor vehicle, the second program module is a safetymodule for checking the functional module, the third program module is amonitoring module at least for checking the safety module, wherein themonitoring module comprises a first monitoring unit including a firstmonitoring element for monitoring the second program module, and asecond monitoring unit including a second monitoring element formonitoring the third program module, the first monitoring unit beingindependent of the second monitoring unit and being configured byrespective and independent state machines to monitor the respectivesecond and third program modules if both state machines are passedthrough successfully.
 2. Method according to claim 1, wherein the firstmonitoring unit performs a first check in the safety module by the firstmonitoring element and the second monitoring unit performs a secondcheck in the monitoring module by the second monitoring element, saidchecks being performed in test paths.
 3. The method according to claim1, wherein the first monitoring unit performs a memory check and aprogram flow check in the safety module as a first check.
 4. The methodaccording to claim 1, wherein the second monitoring unit performs aninstruction set test and an analog to digital converter (ADC) test inthe monitoring module as a second check.
 5. The method according toclaim 1, wherein an error counter is operated when an error is detectedby the first monitoring element or the second monitoring element, and asystem reaction is triggered by the monitoring module independently ofthe functional module when freely programmable error reaction thresholds(thresh, reset thresh) are exceeded.
 6. The method according to claim 1,wherein a response time, a response time window, a disable threshold anda reset threshold are fixed in the computing element apart from otherparameters when the corresponding monitoring unit is configured when thecontrol device is initialized, wherein it is possible that theparameters are not the same for each monitoring unit.
 7. The methodaccording to claim 1, wherein both monitoring units are equallyconfigured.
 8. The method according to claim 1, wherein configuring thecorresponding monitoring unit in the associated state machine is onlypossible in a corresponding state.
 9. The method according to claim 1,wherein only defined state transitions are permitted in a state machineand a return to the state is only performed by a reset.
 10. The methodaccording to claim 1, wherein error counting is performedasymmetrically.
 11. A computing element including three program modulesby which a performance of the motor vehicle is influenced, and whereinthe computing element generates, by the program modules and dependentlyon at least one input quantity, at least one quantity for controlling atleast one function of the motor vehicle, wherein: the first programmodule is a functional module for functional control of the motorvehicle, the second program module is a safety module for checking thefunctional module, the third program module is a monitoring module atleast for checking the safety module, wherein the monitoring modulecomprises a first monitoring element assigned to a first monitoring unitfor monitoring the second program module, and a second monitoringelement assigned to a second monitoring unit for monitoring the thirdprogram module, the first monitoring unit being independent of thesecond monitoring unit and being configured by respective andindependent state machines to monitor the respective second and thirdprogram modules if both state machines are passed through successfully.12. A processor with a computing element, the computing elementincluding: three program modules by which a performance of the motorvehicle is influenced, and wherein the computing element generates, bythe program modules and dependently on at least one input quantity, atleast one quantity for controlling at least one function of the motorvehicle, wherein: the first program module is a functional module forfunctional control of the motor vehicle, the second program module is asafety module for checking the functional module, the third programmodule is a monitoring module at least for checking the safety module,wherein the monitoring module comprises two independent monitoringelements that configure the associated monitoring units, wherein theprocessor comprises a functional computer and a monitoring computer, andwherein the functional module, the safety module and the monitoringmodule are executed on the functional computer and the monitoringcomputer communicates with the functional computer by a dialog methodvia an interface, wherein the functional computer and the monitoringcomputer are physically independent of each other and the monitoringcomputer comprises two monitoring units that are independent of eachother, and wherein for monitoring the proper processing of the programinstructions of the functional computer, one check each can be performedin the functional computer by each monitoring unit.
 13. The processoraccording to claim 12, wherein for monitoring the proper processing ofthe program instructions of the functional computer, one check each canbe performed in a functional computer outside the monitoring computer byeach monitoring unit.